PT-2021-23153 · Nextcloud+1 · Nextcloud+1

Bncrypted · Published 2021-10-25 · Updated 2022-10-25 · CVE-2021-41178

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud versions prior to 20.0.13 Nextcloud versions prior to 21.0.5 Nextcloud versions prior to 22.2.0

Description A file traversal vulnerability in Nextcloud allows an attacker to download arbitrary SVG images from the host system, including user-provided files. This could be leveraged into a XSS/phishing attack by uploading a malicious SVG file that mimics the Nextcloud login form and sending a specially crafted link to victims. However, the XSS risk is mitigated due to Nextcloud's strict Content-Security-Policy, which disallows execution of arbitrary JavaScript.

Recommendations Upgrade to version 20.0.13 or later Upgrade to version 21.0.5 or later Upgrade to version 22.2.0 or later There are no known workarounds aside from upgrading.

Fix

Unrestricted File Upload

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-434

CWE-23

CWE-22

Related Identifiers

CVE-2021-41178

GHSA-JP9C-VPR3-M5RF

OPENSUSE-SU-2021:1602-1

OPENSUSE-SU-2021_1602-1

Affected Products

Nextcloud

Suse

References · 18

• https://github.com/nextcloud/server/pull/28726 · Patch
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41178 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41178 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1602-1 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rf · Note
• https://suse.com/security/cve/CVE-2021-41177 · Note
• https://suse.com/security/cve/CVE-2021-41179 · Note
• https://t.me/cvenotify/34541 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/YPS4NA73653ZFLPRD3JJVTUZZ4PYGDUS · Note
• https://bugzilla.suse.com/1192028 · Note
• https://bugzilla.suse.com/1192031 · Note
• https://hackerone.com/reports/1302155 · Note
• https://t.me/cvenotify/22643 · Telegram Post
• https://bugzilla.suse.com/1192030 · Note